cribra 0.3.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation
name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: "1"

jobs:
  validate:
    name: Validate release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout tagged source
        uses: actions/checkout@v7

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Rust artifacts
        uses: Swatinem/rust-cache@v2.9.1

      - name: Verify clean semantic version tag
        shell: bash
        run: |
          set -euo pipefail

          tag="${GITHUB_REF_NAME}"
          version="${tag#v}"

          package_version="$(
            cargo metadata --no-deps --format-version 1 |
              python3 -c 'import json,sys; print(json.load(sys.stdin)["packages"][0]["version"])'
          )"

          if [[ "$tag" != "v$package_version" ]]; then
            echo "::error::Tag $tag does not match Cargo.toml version $package_version"
            exit 1
          fi

          if [[ "$version" != "$package_version" ]]; then
            echo "::error::Invalid release version"
            exit 1
          fi

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Check all features
        run: cargo check --all-features

      - name: Test all features
        run: cargo test --all-features

      - name: Test rustdoc
        run: cargo test --doc

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Package
        run: cargo package

      - name: Publish dry run
        run: cargo publish --dry-run

  publish:
    name: Publish crates.io
    needs: validate
    runs-on: ubuntu-latest
    environment: release

    steps:
      - name: Checkout tagged source
        uses: actions/checkout@v7

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Authenticate to crates.io
        id: crates-io-auth
        uses: rust-lang/crates-io-auth-action@v1.0.5

      - name: Publish Cribra
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
        run: cargo publish

  github-release:
    name: GitHub Release
    needs: publish
    runs-on: ubuntu-latest

    steps:
      - name: Checkout tagged source
        uses: actions/checkout@v7

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${GITHUB_REF_NAME}" --verify-tag --generate-notes --title "Cribra ${GITHUB_REF_NAME}"